CVE-2026-80907

What it actually does

The UVD DPB minimum size calculation for H264 decoding used the maximum reference count derived from the codec level instead of the actual number of references supplied in the decode message, resulting in allocation of an undersized buffer that can be overrun during decode operations.

Why it matters to the business

Systems using AMD GPUs for hardware-accelerated H264 video decoding may experience crashes, memory corruption, or denial of service when processing streams with reference counts below the level maximum, affecting media playback, video conferencing, and GPU-accelerated workloads.

How an attack unfolds

An attacker crafts or supplies an H264 bitstream whose decode message specifies fewer references than the level maximum; the driver allocates a DPB buffer based on the larger value, but the decoder writes the actual (larger) number of reference frames into the undersized buffer, corrupting adjacent kernel memory.

How to fix it

Update to a Linux kernel containing commit 64b525edb7e7bdfcdc77883c5e413804e2396856 or later; rebuild and deploy the amdgpu module with the corrected DPB size logic that uses the reference count from the decode message.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the amdgpu UVD source for the reference-count-based DPB size calculation; test with H264 streams containing reference counts below the level maximum and verify no buffer-size-related kernel warnings or crashes occur.

Typical attack path

1. Deliver a malicious or malformed H264 stream to a user or service that triggers hardware decode on an AMD GPU
2. Kernel driver parses the decode message and computes DPB size from level maximum rather than actual references
3. UVD engine performs decode and writes reference pictures beyond the allocated buffer
4. Memory corruption occurs in kernel address space, potentially leading to crash or escalation

How to detect it

Review kernel logs for amdgpu UVD buffer allocation warnings or out-of-bounds accesses during H264 decode; correlate with processes invoking VA-API or VDPAU hardware decode on AMD GPUs.

What your security team should do

• Prioritize kernel updates on systems with AMD GPUs that perform H264 hardware decoding
• Restrict untrusted H264 content from reaching GPU decode paths until patched
• Monitor vendor advisories for backported fixes in distribution kernels